pony | 1e8efc7637ffc59dab50429226797d259e877d5fa4737bfc2fab0d1f742d66cc

Analysis

max time kernel
123s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe
Size 2.2MB
Sample240528-m4e4vahe37
SHA256 1e8efc7637ffc59dab50429226797d259e877d5fa4737bfc2fab0d1f742d66cc
MD5 7cb908925cb72d6b693f895de3a97dd2
SHA1 b787068d309b8f23babf734bb787dbd3e4c128b2
SHA512 0985c79aa5d8cdf1a7cdac0e077eed6d405bc04eba1f921576c0d51fe63f38a773ca6571f2d2bd71aaf17237c4ed6c6a153b719b336f838ab34bf85c73c1c1b6
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWwwq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1092	explorer.exe
3024	explorer.exe
4352	spoolsv.exe
544	spoolsv.exe
3712	spoolsv.exe
2604	spoolsv.exe
4920	spoolsv.exe
2668	spoolsv.exe
3040	spoolsv.exe
948	spoolsv.exe
2896	spoolsv.exe
2584	spoolsv.exe
4708	spoolsv.exe
4324	spoolsv.exe
1368	spoolsv.exe
2260	spoolsv.exe
2912	spoolsv.exe
4628	spoolsv.exe
516	spoolsv.exe
3324	spoolsv.exe
3572	spoolsv.exe
4980	spoolsv.exe
2276	spoolsv.exe
3992	spoolsv.exe
3728	spoolsv.exe
1736	spoolsv.exe
4664	spoolsv.exe
2984	spoolsv.exe
4828	spoolsv.exe
3284	spoolsv.exe
2624	spoolsv.exe
1632	spoolsv.exe
2552	spoolsv.exe
3336	explorer.exe
3408	spoolsv.exe
1660	spoolsv.exe
4912	spoolsv.exe
1844	spoolsv.exe
1760	spoolsv.exe
1020	spoolsv.exe
2176	spoolsv.exe
2928	explorer.exe
3128	spoolsv.exe
1672	spoolsv.exe
4972	spoolsv.exe
4500	spoolsv.exe
4824	spoolsv.exe
4092	spoolsv.exe
2096	spoolsv.exe
2072	explorer.exe
1636	spoolsv.exe
4544	spoolsv.exe
3464	spoolsv.exe
3436	spoolsv.exe
2400	spoolsv.exe
2936	explorer.exe
5112	spoolsv.exe
4592	spoolsv.exe
4968	spoolsv.exe
1932	spoolsv.exe
1800	spoolsv.exe
3508	spoolsv.exe
4392	explorer.exe
3592	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 36 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 4264	1728	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe	95
PID 1092 set thread context of 3024	1092	explorer.exe	101
PID 4352 set thread context of 2552	4352	spoolsv.exe	133
PID 544 set thread context of 3408	544	spoolsv.exe	135
PID 3712 set thread context of 1660	3712	spoolsv.exe	136
PID 2604 set thread context of 1844	2604	spoolsv.exe	137
PID 4920 set thread context of 1760	4920	spoolsv.exe	139
PID 2668 set thread context of 1020	2668	spoolsv.exe	140
PID 3040 set thread context of 2176	3040	spoolsv.exe	141
PID 948 set thread context of 3128	948	spoolsv.exe	143
PID 2896 set thread context of 1672	2896	spoolsv.exe	144
PID 2584 set thread context of 4972	2584	spoolsv.exe	145
PID 4708 set thread context of 4824	4708	spoolsv.exe	147
PID 4324 set thread context of 4092	4324	spoolsv.exe	148
PID 1368 set thread context of 2096	1368	spoolsv.exe	149
PID 2260 set thread context of 4544	2260	spoolsv.exe	153
PID 2912 set thread context of 3464	2912	spoolsv.exe	154
PID 4628 set thread context of 3436	4628	spoolsv.exe	155
PID 516 set thread context of 2400	516	spoolsv.exe	156
PID 3324 set thread context of 4592	3324	spoolsv.exe	159
PID 3572 set thread context of 4968	3572	spoolsv.exe	160
PID 4980 set thread context of 1932	4980	spoolsv.exe	161
PID 2276 set thread context of 1800	2276	spoolsv.exe	162
PID 3992 set thread context of 3508	3992	spoolsv.exe	163
PID 3728 set thread context of 1080	3728	spoolsv.exe	166
PID 1736 set thread context of 4180	1736	spoolsv.exe	167
PID 4664 set thread context of 1500	4664	spoolsv.exe	168
PID 2984 set thread context of 5104	2984	spoolsv.exe	169
PID 4828 set thread context of 3564	4828	spoolsv.exe	171
PID 3284 set thread context of 4028	3284	spoolsv.exe	173
PID 2624 set thread context of 3604	2624	spoolsv.exe	175
PID 1632 set thread context of 4364	1632	spoolsv.exe	184
PID 3336 set thread context of 4644	3336	explorer.exe	188
PID 4912 set thread context of 1256	4912	spoolsv.exe	195
PID 2928 set thread context of 5592	2928	explorer.exe	198
PID 4500 set thread context of 5968	4500	spoolsv.exe	200

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4264	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe
4264	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3024	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4264	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe
4264	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
2552	spoolsv.exe
2552	spoolsv.exe
3408	spoolsv.exe
3408	spoolsv.exe
1660	spoolsv.exe
1660	spoolsv.exe
1844	spoolsv.exe
1844	spoolsv.exe
1760	spoolsv.exe
1760	spoolsv.exe
1020	spoolsv.exe
1020	spoolsv.exe
2176	spoolsv.exe
2176	spoolsv.exe
3128	spoolsv.exe
3128	spoolsv.exe
1672	spoolsv.exe
1672	spoolsv.exe
4972	spoolsv.exe
4972	spoolsv.exe
4824	spoolsv.exe
4824	spoolsv.exe
4092	spoolsv.exe
4092	spoolsv.exe
2096	spoolsv.exe
2096	spoolsv.exe
4544	spoolsv.exe
4544	spoolsv.exe
3464	spoolsv.exe
3464	spoolsv.exe
3436	spoolsv.exe
3436	spoolsv.exe
2400	spoolsv.exe
2400	spoolsv.exe
4592	spoolsv.exe
4592	spoolsv.exe
4968	spoolsv.exe
4968	spoolsv.exe
1932	spoolsv.exe
1932	spoolsv.exe
1800	spoolsv.exe
1800	spoolsv.exe
3508	spoolsv.exe
3508	spoolsv.exe
1080	spoolsv.exe
1080	spoolsv.exe
4180	spoolsv.exe
4180	spoolsv.exe
1500	spoolsv.exe
1500	spoolsv.exe
5104	spoolsv.exe
5104	spoolsv.exe
3564	spoolsv.exe
3564	spoolsv.exe
4028	spoolsv.exe
4028	spoolsv.exe
3604	spoolsv.exe
3604	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1388	1728	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe	83
PID 1728 wrote to memory of 1388	1728	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe	83
PID 1728 wrote to memory of 4264	1728	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe	95
PID 1728 wrote to memory of 4264	1728	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe	95
PID 1728 wrote to memory of 4264	1728	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe	95
PID 1728 wrote to memory of 4264	1728	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe	95
PID 1728 wrote to memory of 4264	1728	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe	95
PID 4264 wrote to memory of 1092	4264	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe	96
PID 4264 wrote to memory of 1092	4264	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe	96
PID 4264 wrote to memory of 1092	4264	7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe	96
PID 1092 wrote to memory of 3024	1092	explorer.exe	101
PID 1092 wrote to memory of 3024	1092	explorer.exe	101
PID 1092 wrote to memory of 3024	1092	explorer.exe	101
PID 1092 wrote to memory of 3024	1092	explorer.exe	101
PID 1092 wrote to memory of 3024	1092	explorer.exe	101
PID 3024 wrote to memory of 4352	3024	explorer.exe	102
PID 3024 wrote to memory of 4352	3024	explorer.exe	102
PID 3024 wrote to memory of 4352	3024	explorer.exe	102
PID 3024 wrote to memory of 544	3024	explorer.exe	103
PID 3024 wrote to memory of 544	3024	explorer.exe	103
PID 3024 wrote to memory of 544	3024	explorer.exe	103
PID 3024 wrote to memory of 3712	3024	explorer.exe	104
PID 3024 wrote to memory of 3712	3024	explorer.exe	104
PID 3024 wrote to memory of 3712	3024	explorer.exe	104
PID 3024 wrote to memory of 2604	3024	explorer.exe	105
PID 3024 wrote to memory of 2604	3024	explorer.exe	105
PID 3024 wrote to memory of 2604	3024	explorer.exe	105
PID 3024 wrote to memory of 4920	3024	explorer.exe	106
PID 3024 wrote to memory of 4920	3024	explorer.exe	106
PID 3024 wrote to memory of 4920	3024	explorer.exe	106
PID 3024 wrote to memory of 2668	3024	explorer.exe	108
PID 3024 wrote to memory of 2668	3024	explorer.exe	108
PID 3024 wrote to memory of 2668	3024	explorer.exe	108
PID 3024 wrote to memory of 3040	3024	explorer.exe	109
PID 3024 wrote to memory of 3040	3024	explorer.exe	109
PID 3024 wrote to memory of 3040	3024	explorer.exe	109
PID 3024 wrote to memory of 948	3024	explorer.exe	110
PID 3024 wrote to memory of 948	3024	explorer.exe	110
PID 3024 wrote to memory of 948	3024	explorer.exe	110
PID 3024 wrote to memory of 2896	3024	explorer.exe	111
PID 3024 wrote to memory of 2896	3024	explorer.exe	111
PID 3024 wrote to memory of 2896	3024	explorer.exe	111
PID 3024 wrote to memory of 2584	3024	explorer.exe	112
PID 3024 wrote to memory of 2584	3024	explorer.exe	112
PID 3024 wrote to memory of 2584	3024	explorer.exe	112
PID 3024 wrote to memory of 4708	3024	explorer.exe	113
PID 3024 wrote to memory of 4708	3024	explorer.exe	113
PID 3024 wrote to memory of 4708	3024	explorer.exe	113
PID 3024 wrote to memory of 4324	3024	explorer.exe	114
PID 3024 wrote to memory of 4324	3024	explorer.exe	114
PID 3024 wrote to memory of 4324	3024	explorer.exe	114
PID 3024 wrote to memory of 1368	3024	explorer.exe	115
PID 3024 wrote to memory of 1368	3024	explorer.exe	115
PID 3024 wrote to memory of 1368	3024	explorer.exe	115
PID 3024 wrote to memory of 2260	3024	explorer.exe	116
PID 3024 wrote to memory of 2260	3024	explorer.exe	116
PID 3024 wrote to memory of 2260	3024	explorer.exe	116
PID 3024 wrote to memory of 2912	3024	explorer.exe	117
PID 3024 wrote to memory of 2912	3024	explorer.exe	117
PID 3024 wrote to memory of 2912	3024	explorer.exe	117
PID 3024 wrote to memory of 4628	3024	explorer.exe	118
PID 3024 wrote to memory of 4628	3024	explorer.exe	118
PID 3024 wrote to memory of 4628	3024	explorer.exe	118
PID 3024 wrote to memory of 516	3024	explorer.exe	119

C:\Users\Admin\AppData\Local\Temp\7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1388
- C:\Users\Admin\AppData\Local\Temp\7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\7cb908925cb72d6b693f895de3a97dd2_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4264
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3336
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2928
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2896
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2072
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2400
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2936
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2276
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3508
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4392
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3564
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1604
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3604
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1720
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4364
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1184
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1256
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2324
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5968
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:6028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3308
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5696
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2120
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1676
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 1c9dc7eb2cfa6f1aa17aa62cd7ec3d11b2c2c8a4f7c5c5046c020f6377774228
MD5 96c7f62666528d2248e8e72c617591c3
SHA1 57f8de67be1fd81499725510c2b12a53af42d3c5
SHA512 18b286a799cb06d6875f4557f19014863099528c6453a722875aaf7c4b39946bee5500aaa92dccdb0d475611e731af4be45e8a8d9bb0960b88c2f80be2073fbf
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZm:0UzeyQMS4DqodCnoe+iitjWww6
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 724917f426d488cfc7e3118b711919eb68cfe38bfdbf26c8811135bb20b26e30
MD5 c25d994ae2afbbac9599a79ed4b7eb0d
SHA1 8d6f99badcb7c6ea9a2654baedf76261964aad76
SHA512 760b8b31de8c4effbf9fe0070739a8af972f1733e9dd571ae8a135bd4b870dd793a60eeb02048a50ce3fb5a726a5d2c3fa76d6a550bb0337e146410e35678a17
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZj:0UzeyQMS4DqodCnoe+iitjWwwn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/316-5252-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/516-1892-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/544-1970-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/544-1020-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/948-1360-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1020-2134-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1080-2867-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1092-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1092-84-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1140-5220-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1252-5320-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1256-4126-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1368-1710-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1500-2888-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1660-1980-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1660-1981-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/1672-2201-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1672-5242-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1672-5240-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1676-5304-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1728-32-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1728-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1728-0-0x0000000002570000-0x0000000002571000-memory.dmp

Download

memory/1728-28-0x0000000002570000-0x0000000002571000-memory.dmp

Download

memory/1760-2087-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-2673-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-2677-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1844-2065-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2096-2380-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2096-2539-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2120-5093-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2160-5329-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2176-2182-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2260-1711-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2276-1979-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2328-5292-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2400-2556-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2552-1961-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2552-2148-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2584-1362-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2604-2066-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2604-1022-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2668-1204-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2896-1361-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2912-1712-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3024-89-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3024-833-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3040-1205-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3128-2190-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3308-4587-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3308-4699-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3324-1893-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3408-1969-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3436-2485-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3464-2473-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3464-2477-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3508-2763-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3508-2954-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3564-3115-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3564-3047-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3572-1959-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3604-3241-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3712-1982-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3712-1021-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3992-2068-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4028-3055-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4032-5229-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4092-2360-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4180-2878-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4264-73-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4264-29-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4264-31-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4324-1526-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4352-834-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4352-1962-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4364-3566-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4364-3653-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4544-2465-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4592-2646-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4628-1891-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4644-3757-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4644-3753-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4708-1525-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4824-2302-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4920-1203-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4968-2655-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4972-2212-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4980-1960-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5164-5371-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5284-4503-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5300-5190-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5432-4860-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5432-4863-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5516-5202-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5592-4152-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5616-5212-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5696-4964-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5696-4872-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5700-5084-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5852-5283-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5872-5263-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5968-4227-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5968-4339-0x0000000000400000-0x000000000043E000-memory.dmp

Download